GHSA-2272-4vv8-65ww: Traefik before 2.11.58 and 3.7.13 mTLS Bypass via Negated Host Matcher
Traefik before 2.11.58 and 3.7.13 contains an authentication bypass vulnerability that allows unauthenticated clients to skip client-certificate checks because negated Host matchers are counted as served domains. Attackers can reach backends protected by RequireAndVerifyClientCert when a router rule with !Host() creates a TLS options conflict that falls back to the default options.
Affected Software
Event History
Frequently Asked Questions
Which deployments are exposed to this issue?
Affected deployments use Traefik before 2.11.58 or 3.7.13 and have backends protected by RequireAndVerifyClientCert. Exposure requires a router rule containing a negated Host matcher, !Host(), that creates a TLS options conflict and causes fallback to default options.
Does exploitation require credentials or user interaction?
No. The issue can be exploited by unauthenticated clients, and the supplied vector indicates network access with low attack complexity and no user interaction.
What should be done to remediate the issue?
Upgrade Traefik to 2.11.58 or 3.7.13, as applicable. Review router rules using !Host() and identify cases where TLS option conflicts could cause fallback to the default TLS options.
How can I determine whether my configuration may already be affected?
Check whether the Traefik version is earlier than 2.11.58 or 3.7.13. Then review routers for !Host() matchers and determine whether they conflict with TLS options on routes intended to enforce RequireAndVerifyClientCert.